Many companies do the right thing. They find Oracle Java across the estate, they take it off, and they move workloads to a free OpenJDK distribution. Then an audit arrives, reaches back across the three year lookback, and charges them anyway, because nothing in their records proves when the removal happened. Removal without documentation is invisible to an auditor. The work was done, but the credit is lost. Documenting removal is what converts a good housekeeping decision into a defensible reduction in exposure.
This article is part of the Java Audit Survival Guide, the buyer side pillar on defending an Oracle Java audit. Removal evidence is one of the most underused defenses there is.
Why removal needs a paper trail
LMS audits in 2026 reach back three years, and in the absence of dated evidence Oracle reads that period at its broadest. A binary that was uninstalled eighteen months ago can be treated as present for the entire lookback unless you can show otherwise. The metric then prices that assumed presence against your counted population. The only thing standing between you and a charge for software you no longer run is a record that fixes the removal in time. The way the lookback amplifies undocumented history is detailed in the three year lookback in Oracle Java audits.
What good removal evidence looks like
Strong evidence is dated, system generated where possible, and tied to specific machines. Aim to capture:
- Uninstall logs or endpoint management records showing the date Oracle Java was removed from each host.
- Configuration management or imaging records showing the version that replaced it, especially a free OpenJDK distribution.
- Change tickets that authorize and date the removal, linking it to a project or a decision.
- Asset inventory snapshots before and after, so the reduction in Oracle Java is visible over time.
- Decommission records for machines that were retired entirely rather than reimaged.
The aim is a record that an auditor cannot wave away: a date, a machine, and a system that generated the entry. A spreadsheet typed up after the fact is weaker than a log written by the tool that performed the removal.
Capture it as you go, not under pressure
The best removal evidence is created at the moment of removal, not reconstructed once a letter arrives. Build the capture into the removal project itself. When a workload moves off Oracle Java, record the date, the host, the new distribution, and the ticket in the same step. This turns your migration into a defense that is ready the day an audit opens, rather than a scramble to prove history you can no longer see.
| Removal record | Without it | With it |
|---|---|---|
| Dated uninstall log | Binary assumed present for full lookback | Charged only up to the removal date |
| Replacement distribution recorded | Workload read as Oracle Java | Shown as a free distribution, excluded |
| Decommission record | Retired host still counted | Host removed from scope |
| Before and after inventory | No proof of reduction | Reduction visible and dated |
Indicative worked example. A financial services firm had migrated most of its estate off Oracle Java more than a year before an audit but kept no dated removal records. Faced with a claim spanning the full lookback, it reconstructed dates from endpoint management logs and decommission tickets, proving when each workload left Oracle Java. The chargeable period collapsed to the months before removal, and the claim followed. Figures are indicative.
Tie removal into the wider defense
Removal evidence works alongside the other records that bound a claim: installation dates, migration records, and entity history. Together they let you answer an audit from a documented timeline rather than concede Oracle's assumptions. The broader evidence set that wins a defense is covered in evidence that wins a Java audit defense.
The bottom line
Removing Oracle Java reduces your exposure only if you can prove when it happened. The three year lookback charges for everything it cannot see you remove, so dated uninstall logs, replacement records, and decommission tickets are what convert removal into a defense. Capture the evidence at the moment of removal, keep it ready, and the audit measures what truly remained rather than what Oracle is free to assume.
Next step. Get a Quote and we will help you assemble removal evidence that holds up and limits the lookback. Submit the form to Get a Quote. We work on a Fixed Fee from $18,000 or a Gainshare share of verified savings or avoided exposure, with zero retainer and no risk to you.